<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->


<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->

<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->

<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->

<!DOCTYPE html
  PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-us" xml:lang="en-us">
<head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
   
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="DC.Type" content="topic">
<meta name="DC.Title" content="Enabling Intelligent Ransomware Detection">
<meta name="product" content="">
<meta name="DC.Relation" scheme="URI" content="en-us_topic_0000001336887429.html">
<meta name="prodname" content="">
<meta name="version" content="">
<meta name="brand" content="Anti-Ransomware ProtectManager">
<meta name="DC.Publisher" content="20220726">
<meta name="DC.Format" content="XHTML">
<meta name="DC.Identifier" content="EN-US_TOPIC_0000001282909078">
<meta name="DC.Language" content="en-us">
<link rel="stylesheet" type="text/css" href="public_sys-resources/commonltr.css">
<title>Enabling Intelligent Ransomware Detection</title>
</head>
<body style="clear:both; padding-left:10px; padding-top:5px; padding-right:5px; padding-bottom:5px"><a name="EN-US_TOPIC_0000001282909078"></a><a name="EN-US_TOPIC_0000001282909078"></a>

<h1 class="topictitle1">Enabling Intelligent Ransomware Detection</h1>
<div id="body0000001282909078"><p id="EN-US_TOPIC_0000001282909078__p8060118">The system detects known ransomware attack features to identify whether file systems are attacked by ransomware. If no ransomware attack is identified, the system analyzes and compares file system snapshot changes, and uses machine learning algorithms to further check whether the file systems are infected by ransomware. This section describes how to enable intelligent ransomware detection.</p>
<div class="section" id="EN-US_TOPIC_0000001282909078__section17802133125417"><h4 class="sectiontitle">Precautions</h4><p id="EN-US_TOPIC_0000001282909078__p57622222314">During intelligent ransomware detection, if the file system snapshot directory corresponding to the ransomware detection snapshot being detected is invisible, the system will create a clone file system whose name starts with <strong id="EN-US_TOPIC_0000001282909078__b958173135214">DEE-ANTI-CLONE</strong> based on the ransomware detection snapshot. The clone file system is used to generate metadata features of the snapshot. During the detection, do not delete or rename the clone file system whose name starts with <strong id="EN-US_TOPIC_0000001282909078__b724901610481">DEE-ANTI-CLONE</strong>. If the file is deleted or renamed, the detection may fail. After the intelligent ransomware detection, the system automatically deletes the clone file system whose name starts with <strong id="EN-US_TOPIC_0000001282909078__b1989612985119">DEE-ANTI-CLONE</strong>.</p>
</div>
<div class="section" id="EN-US_TOPIC_0000001282909078__section1487541317382"><h4 class="sectiontitle">Procedure</h4><ol id="EN-US_TOPIC_0000001282909078__ol13790921131411"><li id="EN-US_TOPIC_0000001282909078__en-us_topic_0000001166366216_en-us_topic_0000001091431193_li1570821013536"><span>On the navigation pane, choose <strong id="EN-US_TOPIC_0000001282909078__en-us_topic_0000001283108982_en-us_topic_0000001337156461_b968420581014">Explore</strong> &gt; <strong id="EN-US_TOPIC_0000001282909078__en-us_topic_0000001283108982_en-us_topic_0000001337156461_b1768411561010">Ransomware Protection</strong> &gt; <strong id="EN-US_TOPIC_0000001282909078__en-us_topic_0000001283108982_en-us_topic_0000001337156461_b176841857102">Ransomware Detection</strong>.</span></li><li id="EN-US_TOPIC_0000001282909078__li5362122616287"><span>On the <span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol12890172918"><b>Detection Settings</b></span> tab page, select the vStore for which you want to enable intelligent ransomware detection and choose <span class="menucascade" id="EN-US_TOPIC_0000001282909078__menucascade146832554715"><b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol126822574714">More</span></b> &gt; <b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol0572572474">Enable Intelligent Ransomware Detection</span></b></span>. After intelligent ransomware detection is enabled, you need to create a ransomware detection snapshot by referring to <a href="en-us_topic_0000001283134340.html">Creating a Ransomware Detection Snapshot</a>. After the snapshot is generated, the system immediately performs ransomware detection on the snapshot.</span><p><div class="note" id="EN-US_TOPIC_0000001282909078__note751754763520"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="EN-US_TOPIC_0000001282909078__ul169632023112316"><li id="EN-US_TOPIC_0000001282909078__li78251254173914">You can also select multiple vStores for which you want to enable intelligent ransomware detection and choose <span class="menucascade" id="EN-US_TOPIC_0000001282909078__menucascade9651115518235"><b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol10651135519235">More</span></b> &gt; <b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol265119550232">Enable Intelligent Ransomware Detection</span></b></span> above the vStore list.</li><li id="EN-US_TOPIC_0000001282909078__li1963132314231">If intelligent ransomware detection is not required, choose <span class="menucascade" id="EN-US_TOPIC_0000001282909078__menucascade7354152611471"><b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol2354112613470">More</span></b> &gt; <b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol153545264471">Disable Intelligent Ransomware Detection</span></b></span>. Alternatively, you can select multiple vStores for which you want to disable intelligent ransomware detection and choose <span class="menucascade" id="EN-US_TOPIC_0000001282909078__menucascade184451156161513"><b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol5445356171515">More</span></b> &gt; <b><span class="uicontrol" id="EN-US_TOPIC_0000001282909078__uicontrol6445105691518">Disable Intelligent Ransomware Detection</span></b></span> above the vStore list.</li></ul>
</div></div>
</p></li></ol>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0000001336887429.html">Using Intelligent Ransomware Detection</a></div>
</div>
</div>

<div class="hrcopyright"><hr size="2"></div><div class="hwcopyright">Copyright &copy; Huawei Technologies Co., Ltd.</div></body>
</html>